SlideShare a Scribd company logo
© 2021 Cisco and/or its affiliates. All rights reserved.
Open Source API Observability Tool
Zohar Kaufman, Alexei Kravtsov
Sep 2021
© 2021 Cisco and/or its affiliates. All rights reserved.
Agenda
Why do we need API
Specs reconstruction ?
Possible open source
packages survey
Introducing APIClarity
(design, architecture)
It’s Demo Time Roadmap & closing
comments
Q&A
© 2021 Cisco and/or its affiliates. All rights reserved.
Cloud services and microservices architecture gaining popularity
Typically using OpenAPI Specification:
Standard, language-agnostic
interface
Allows both humans and
computers to discover and
understand the capabilities of
a service
No access to source code or
other documentation is needed
Interface files for describing, producing, consuming, and visualizing RESTful web services
Allows parallel development of client and server applications using generated code and mocks
OpenAPI Specs
© 2021 Cisco and/or its affiliates. All rights reserved.
API Specs Challenges
Not all applications have their OpenAPI specification available (legacy,
external)
Designed API vs Runtime API
Deprecated APIs
(Zombie APIs)
Undocumented
APIs (Shadow
APIs)
Breaking
changes
Differences
over time
Obtaining OpenAPI Spec without code instrumentation or modifying existing
workloads
© 2021 Cisco and/or its affiliates. All rights reserved.
API Specs Challenges - Gartner
Every connected mobile, modern
web or cloud-hosted application uses
and exposes APIs:
Easy to expose
but difficult to
defend
Used to access
data and to call
application functionality
Large and growing attack surface, leading
to a growing number of publicized API
attacks and breaches
© 2021 Cisco and/or its affiliates. All rights reserved.
Existing Open Source Solutions
Similar products:
Akita, Imvision, Salt
Open sources:
Optic, Avantation, har2openapi, Response2Schema,
InducOapi, SwagDefGen
Community tool (free but not open source):
API Shark, SwaggerHub
List of Tools:
Open API Tools, API Specification Toolbox
© 2021 Cisco and/or its affiliates. All rights reserved.
Open API Tools https://openapi.tools/
Tool Types
• Auto Generators: Tools that will take your code and turn it into an OpenAPI Specification document
• Converters: Various tools to convert to and from OpenAPI and other API description formats
• Data Validators: Check to see if API requests and responses are lining up with the API description
• Description Validators: Check your API description to see if it is valid OpenAPI
• Documentation: Render API Description as HTML (or maybe a PDF) so slightly less technical people can figure out how to work with the API
• DSL: Writing YAML by hand is no fun, and maybe you don't want a GUI, so use a Domain Specific Language to write OpenAPI in your language of choice
• GUI Editors: Visual editors help you design APIs without needing to memorize the entire OpenAPI specification
• Learning: Whether you're trying to get documentation for a third-party API based on traffic or are trying to switch to design-first at an organization with no
OpenAPI at all, learning can help you move your API spec forward and keep it up to date
• Miscellaneous: Anything else that does stuff with OpenAPI but hasn't quite got enough to warrant its own category
• Mock Servers: Fake servers that take description document as input, then route incoming HTTP requests to example responses or dynamically generates
examples
• Parsers: Loads and read OpenAPI descriptions, so you can work with them programmatically
• SDK Generators: Generate code to give to consumers, to help them avoid interacting at a HTTP level
• Security: By poking around your OpenAPI description, some tools can look out for attack vectors you might not have noticed
• Server Implementations: Easily create and implement resources and routes for your APIs
• Testing: Quickly execute API requests and validate responses on the fly through command line or GUI interfaces
• Text Editors: Text editors give you visual feedback whilst you write OpenAPI, so you can see what docs might look like
© 2021 Cisco and/or its affiliates. All rights reserved.
API Specification Toolbox http://api.specificationtoolbox.com/services/
© 2021 Cisco and/or its affiliates. All rights reserved.
Optic
Open Source tool
Helps developers to document, review and approve API
changes prior to deploying them
Language agnostic, works with any REST API
Observes development traffic and learns your API’s
behavior
Detects API changes by diffing traffic against the current
specification
Adds an accurate API changelog to every Pull Request
Mechanism to manually review and update the specification
Not designed to monitor multi service environments
© 2021 Cisco and/or its affiliates. All rights reserved.
SwaggerHub
No need for a setup – generate API
traffic from Web UI
Records API traffic and converts it to
OAS using SwaggerHub
Not an open source
No integration with runtime environments
© 2021 Cisco and/or its affiliates. All rights reserved.
API Shark
Live monitoring of multi-service environments
OAS spec learning from runtime traffic
Automatic parameter detection
Seamless
No Spec Diff detection
Not an open source
No review option of the learned spec
© 2021 Cisco and/or its affiliates. All rights reserved.
Live monitoring of multi-service environments
Spec Diff detection
Not free
Not an open source
Imvision API
Security
OAS spec learning from runtime traffic
Mechanism to manually review and update the
specification
© 2021 Cisco and/or its affiliates. All rights reserved.
No code changes are needed to any of your App
Construct the OpenAPI specification by observing the
API traffic
UI dashboard to audit and monitor the API findings
Alert the user on any difference between the
approved API specification and the one that is
observed in runtime, detects shadow & zombie APIs
Introducing
APIClarity
Capture all API traffic in an existing environment
using a service-mesh framework
Allow the User to upload OpenAPI spec, review,
modify and approve generated OpenAPI specs
© 2021 Cisco and/or its affiliates. All rights reserved.
APIClarity: High-Level Architecture
Users
Istio
Client App
Envoy Proxy
Fronted App
Envoy Proxy
Backend App
Envoy Proxy
POST/login
GET/clients
Mirror API
traffic from
Proxies
OpenAPI Spec Engine
UI
• API events
• Learned Specs
• API Diff
API spec
user review
Frontend
Pod
Client
Pod
Backend
Pod
K8s
Cluster
© 2021 Cisco and/or its affiliates. All rights reserved.
Spec Reconstruction Features
Parameter detection
(Path, query, header, cookie)
Object references
Security definitions
File transfer
© 2021 Cisco and/or its affiliates. All rights reserved.
Demo Environment
K8s cluster Istio service
mesh
APIClarity
installed
Sock-shop
demo app
Setup
© 2021 Cisco and/or its affiliates. All rights reserved.
Demo Flow
1 2 3 4 5 6 7
APIClarity
deployment overview
(clone, build, deploy)
Visibility of runtime
API events
Event filtering, hit
count graphs
OAS learning –
generating traffic
using the sock-shop
demo app
Review of
automatically
generated OAS
learned from the
traffic
Approve the
reviewed spec and
see in Swagger UI
User provided spec
Monitor and observe
whether the API events
correspond to set specs
API event diffs, Shadow
APIs, Zombie APIs
© 2021 Cisco and/or its affiliates. All rights reserved.
It’s Demo
Time
© 2021 Cisco and/or its affiliates. All rights reserved.
© 2021 Cisco and/or its affiliates. All rights reserved.
API development and security aspects of APIClarity
Analyze spec for security
issues and best practices
Run API fuzzing tests
using the spec
Generate Client and
Server code
Generate Client and
Server mocks
Documentation
Knowing the
API Spec
is the first
step to
identifying
your API
risks Mock
generation
Documentation
Fuzzing
tests
OAS issue
analysis
Security Development
Code
generation
© 2021 Cisco and/or its affiliates. All rights reserved.
Roadmap
OAS 3.0,
GraphQL, gRPC
Integration with
additional
environments
(Browsers,
Postman, API
gateways, etc.)
Support spec
schema review
in UI
System
settings
User
management
© 2021 Cisco and/or its affiliates. All rights reserved.
Questions?
© 2021 Cisco and/or its affiliates. All rights reserved.

More Related Content

What's hot

Realize True Business Value With ThousandEyes
Realize True Business Value With ThousandEyesRealize True Business Value With ThousandEyes
Realize True Business Value With ThousandEyes
ThousandEyes
 
API Monetization
API MonetizationAPI Monetization
API Monetization
Capgemini
 
How Secure Are Your APIs?
How Secure Are Your APIs?How Secure Are Your APIs?
How Secure Are Your APIs?
Apigee | Google Cloud
 
Deep dive: Monetize your API Programs
Deep dive: Monetize your API ProgramsDeep dive: Monetize your API Programs
Deep dive: Monetize your API Programs
Apigee | Google Cloud
 
Apigee Demo: API Platform Overview
Apigee Demo: API Platform OverviewApigee Demo: API Platform Overview
Apigee Demo: API Platform Overview
Apigee | Google Cloud
 
WSO2 API Manager Community Call - November 2021
WSO2 API Manager Community Call - November 2021WSO2 API Manager Community Call - November 2021
WSO2 API Manager Community Call - November 2021
WSO2
 
Introduction to Kong API Gateway
Introduction to Kong API GatewayIntroduction to Kong API Gateway
Introduction to Kong API Gateway
Yohann Ciurlik
 
API Management
API ManagementAPI Management
API Management
Prolifics
 
API Management Solution Powerpoint Presentation Slides
API Management Solution Powerpoint Presentation SlidesAPI Management Solution Powerpoint Presentation Slides
API Management Solution Powerpoint Presentation Slides
SlideTeam
 
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
apidays
 
API Management in Digital Transformation
API Management in Digital TransformationAPI Management in Digital Transformation
API Management in Digital Transformation
Aditya Thatte
 
Apigee Product Roadmap Part 2
Apigee Product Roadmap Part 2Apigee Product Roadmap Part 2
Apigee Product Roadmap Part 2
Apigee | Google Cloud
 
Schema-First API Design
Schema-First API DesignSchema-First API Design
Schema-First API Design
Yos Riady
 
Building an API Factory: Turn your APIs into Products
Building an API Factory: Turn your APIs into ProductsBuilding an API Factory: Turn your APIs into Products
Building an API Factory: Turn your APIs into Products
Nuwan Dias
 
Apigee Products Overview
Apigee Products OverviewApigee Products Overview
Apigee Products Overview
Apigee | Google Cloud
 
Apigee Edge Overview and Roadmap
Apigee Edge Overview and RoadmapApigee Edge Overview and Roadmap
Apigee Edge Overview and Roadmap
Apigee | Google Cloud
 
Trainer Partnership Simplilearn
Trainer Partnership SimplilearnTrainer Partnership Simplilearn
Trainer Partnership SimplilearnBeryl John
 
Azure API Management
Azure API ManagementAzure API Management
Azure API Management
Daniel Toomey
 
API Strategy Introduction
API Strategy IntroductionAPI Strategy Introduction
API Strategy Introduction
Doug Gregory
 
Architecting an Enterprise API Management Strategy
Architecting an Enterprise API Management StrategyArchitecting an Enterprise API Management Strategy
Architecting an Enterprise API Management Strategy
WSO2
 

What's hot (20)

Realize True Business Value With ThousandEyes
Realize True Business Value With ThousandEyesRealize True Business Value With ThousandEyes
Realize True Business Value With ThousandEyes
 
API Monetization
API MonetizationAPI Monetization
API Monetization
 
How Secure Are Your APIs?
How Secure Are Your APIs?How Secure Are Your APIs?
How Secure Are Your APIs?
 
Deep dive: Monetize your API Programs
Deep dive: Monetize your API ProgramsDeep dive: Monetize your API Programs
Deep dive: Monetize your API Programs
 
Apigee Demo: API Platform Overview
Apigee Demo: API Platform OverviewApigee Demo: API Platform Overview
Apigee Demo: API Platform Overview
 
WSO2 API Manager Community Call - November 2021
WSO2 API Manager Community Call - November 2021WSO2 API Manager Community Call - November 2021
WSO2 API Manager Community Call - November 2021
 
Introduction to Kong API Gateway
Introduction to Kong API GatewayIntroduction to Kong API Gateway
Introduction to Kong API Gateway
 
API Management
API ManagementAPI Management
API Management
 
API Management Solution Powerpoint Presentation Slides
API Management Solution Powerpoint Presentation SlidesAPI Management Solution Powerpoint Presentation Slides
API Management Solution Powerpoint Presentation Slides
 
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
Apidays Paris 2023 - 7 Mistakes When Putting In Place An API Program, Francoi...
 
API Management in Digital Transformation
API Management in Digital TransformationAPI Management in Digital Transformation
API Management in Digital Transformation
 
Apigee Product Roadmap Part 2
Apigee Product Roadmap Part 2Apigee Product Roadmap Part 2
Apigee Product Roadmap Part 2
 
Schema-First API Design
Schema-First API DesignSchema-First API Design
Schema-First API Design
 
Building an API Factory: Turn your APIs into Products
Building an API Factory: Turn your APIs into ProductsBuilding an API Factory: Turn your APIs into Products
Building an API Factory: Turn your APIs into Products
 
Apigee Products Overview
Apigee Products OverviewApigee Products Overview
Apigee Products Overview
 
Apigee Edge Overview and Roadmap
Apigee Edge Overview and RoadmapApigee Edge Overview and Roadmap
Apigee Edge Overview and Roadmap
 
Trainer Partnership Simplilearn
Trainer Partnership SimplilearnTrainer Partnership Simplilearn
Trainer Partnership Simplilearn
 
Azure API Management
Azure API ManagementAzure API Management
Azure API Management
 
API Strategy Introduction
API Strategy IntroductionAPI Strategy Introduction
API Strategy Introduction
 
Architecting an Enterprise API Management Strategy
Architecting an Enterprise API Management StrategyArchitecting an Enterprise API Management Strategy
Architecting an Enterprise API Management Strategy
 

Similar to Api clarity webinar

apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
apidays
 
the 12 facets of OpenAPI
the 12 facets of OpenAPIthe 12 facets of OpenAPI
the 12 facets of OpenAPI
Cisco DevNet
 
API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)
Tom Johnson
 
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, CiscoApidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
apidays
 
Presentation at the 2016 Linux Foundation Collab Summit
Presentation at the 2016 Linux Foundation Collab SummitPresentation at the 2016 Linux Foundation Collab Summit
Presentation at the 2016 Linux Foundation Collab Summit
Open API Initiative (OAI)
 
Extend soa with api management Sangam18
Extend soa with api management Sangam18Extend soa with api management Sangam18
Extend soa with api management Sangam18
Vinay Kumar
 
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, CiscoApidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
apidays
 
Api design part 1
Api design part 1Api design part 1
Api design part 1
Ibrahim Elsawaf
 
Anypoint connector Roadmap
Anypoint connector RoadmapAnypoint connector Roadmap
Anypoint connector Roadmap
danishsm84
 
Extend soa with api management spoug- Madrid
Extend soa with api management   spoug- MadridExtend soa with api management   spoug- Madrid
Extend soa with api management spoug- Madrid
Vinay Kumar
 
Oracle API Platform Cloud Service Best Practices & Lessons Learnt
Oracle API Platform Cloud Service Best Practices & Lessons LearntOracle API Platform Cloud Service Best Practices & Lessons Learnt
Oracle API Platform Cloud Service Best Practices & Lessons Learnt
luisw19
 
18 facets of the OpenAPI specification - Cisco Live US 2023
18 facets of the OpenAPI specification - Cisco Live US 202318 facets of the OpenAPI specification - Cisco Live US 2023
18 facets of the OpenAPI specification - Cisco Live US 2023
Cisco DevNet
 
The 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdfThe 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdf
Cisco DevNet
 
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
HostedbyConfluent
 
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
apidays
 
API Conference 2021
API Conference 2021API Conference 2021
API Conference 2021
José Haro Peralta
 
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
apidays
 

Similar to Api clarity webinar (20)

apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
apidays Paris 2022 - The 12 Facets of the OpenAPI Specification, Steve Sfartz...
 
the 12 facets of OpenAPI
the 12 facets of OpenAPIthe 12 facets of OpenAPI
the 12 facets of OpenAPI
 
API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)API workshop: Introduction to APIs (TC Camp)
API workshop: Introduction to APIs (TC Camp)
 
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, CiscoApidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
Apidays Paris 2023 - Managing OpenAPI Documents at Scale, Stéve Sfartz, Cisco
 
Presentation at the 2016 Linux Foundation Collab Summit
Presentation at the 2016 Linux Foundation Collab SummitPresentation at the 2016 Linux Foundation Collab Summit
Presentation at the 2016 Linux Foundation Collab Summit
 
Extend soa with api management Sangam18
Extend soa with api management Sangam18Extend soa with api management Sangam18
Extend soa with api management Sangam18
 
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, CiscoApidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
Apidays Paris 2023 - Why API Contracts Matter, Stève Sfartz, Cisco
 
Api design part 1
Api design part 1Api design part 1
Api design part 1
 
Anypoint connector Roadmap
Anypoint connector RoadmapAnypoint connector Roadmap
Anypoint connector Roadmap
 
Extend soa with api management spoug- Madrid
Extend soa with api management   spoug- MadridExtend soa with api management   spoug- Madrid
Extend soa with api management spoug- Madrid
 
Oracle API Platform Cloud Service Best Practices & Lessons Learnt
Oracle API Platform Cloud Service Best Practices & Lessons LearntOracle API Platform Cloud Service Best Practices & Lessons Learnt
Oracle API Platform Cloud Service Best Practices & Lessons Learnt
 
18 facets of the OpenAPI specification - Cisco Live US 2023
18 facets of the OpenAPI specification - Cisco Live US 202318 facets of the OpenAPI specification - Cisco Live US 2023
18 facets of the OpenAPI specification - Cisco Live US 2023
 
The 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdfThe 12 facets of the OpenAPI standard.pdf
The 12 facets of the OpenAPI standard.pdf
 
Api tools overview
Api tools overviewApi tools overview
Api tools overview
 
Day 1 axway apim-training
Day 1   axway apim-trainingDay 1   axway apim-training
Day 1 axway apim-training
 
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
Apicurio Registry: Event-driven APIs & Schema governance for Apache Kafka | F...
 
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
APIdays Barcelona 2019 - How a Cloud native Architecture helps to drive Busin...
 
API Presentation
API PresentationAPI Presentation
API Presentation
 
API Conference 2021
API Conference 2021API Conference 2021
API Conference 2021
 
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
apidays LIVE Paris 2021 - Lessons from the API Stewardship Journey in Azure b...
 

More from LibbySchulze

Running distributed tests with k6.pdf
Running distributed tests with k6.pdfRunning distributed tests with k6.pdf
Running distributed tests with k6.pdf
LibbySchulze
 
Extending Kubectl.pptx
Extending Kubectl.pptxExtending Kubectl.pptx
Extending Kubectl.pptx
LibbySchulze
 
Enhancing Data Protection Workflows with Kanister And Argo Workflows
Enhancing Data Protection Workflows with Kanister And Argo WorkflowsEnhancing Data Protection Workflows with Kanister And Argo Workflows
Enhancing Data Protection Workflows with Kanister And Argo Workflows
LibbySchulze
 
Fallacies in Platform Engineering.pdf
Fallacies in Platform Engineering.pdfFallacies in Platform Engineering.pdf
Fallacies in Platform Engineering.pdf
LibbySchulze
 
Intro to Fluvio.pptx.pdf
Intro to Fluvio.pptx.pdfIntro to Fluvio.pptx.pdf
Intro to Fluvio.pptx.pdf
LibbySchulze
 
Enhance your Kafka Infrastructure with Fluvio.pptx
Enhance your Kafka Infrastructure with Fluvio.pptxEnhance your Kafka Infrastructure with Fluvio.pptx
Enhance your Kafka Infrastructure with Fluvio.pptx
LibbySchulze
 
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdfCNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
LibbySchulze
 
Oh The Places You'll Sign.pdf
Oh The Places You'll Sign.pdfOh The Places You'll Sign.pdf
Oh The Places You'll Sign.pdf
LibbySchulze
 
Rancher MasterClass - Avoiding-configuration-drift.pptx
Rancher  MasterClass - Avoiding-configuration-drift.pptxRancher  MasterClass - Avoiding-configuration-drift.pptx
Rancher MasterClass - Avoiding-configuration-drift.pptx
LibbySchulze
 
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptxvFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
LibbySchulze
 
CNCF Live Webinar: Low Footprint Java Containers with GraalVM
CNCF Live Webinar: Low Footprint Java Containers with GraalVMCNCF Live Webinar: Low Footprint Java Containers with GraalVM
CNCF Live Webinar: Low Footprint Java Containers with GraalVM
LibbySchulze
 
EnRoute-OPA-Integration.pdf
EnRoute-OPA-Integration.pdfEnRoute-OPA-Integration.pdf
EnRoute-OPA-Integration.pdf
LibbySchulze
 
AirGap_zusammen_neu.pdf
AirGap_zusammen_neu.pdfAirGap_zusammen_neu.pdf
AirGap_zusammen_neu.pdf
LibbySchulze
 
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
LibbySchulze
 
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
LibbySchulze
 
CNCF_ A step to step guide to platforming your delivery setup.pdf
CNCF_ A step to step guide to platforming your delivery setup.pdfCNCF_ A step to step guide to platforming your delivery setup.pdf
CNCF_ A step to step guide to platforming your delivery setup.pdf
LibbySchulze
 
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdfCNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
LibbySchulze
 
Securing Windows workloads.pdf
Securing Windows workloads.pdfSecuring Windows workloads.pdf
Securing Windows workloads.pdf
LibbySchulze
 
Securing Windows workloads.pdf
Securing Windows workloads.pdfSecuring Windows workloads.pdf
Securing Windows workloads.pdf
LibbySchulze
 
Advancements in Kubernetes Workload Identity for Azure
Advancements in Kubernetes Workload Identity for AzureAdvancements in Kubernetes Workload Identity for Azure
Advancements in Kubernetes Workload Identity for Azure
LibbySchulze
 

More from LibbySchulze (20)

Running distributed tests with k6.pdf
Running distributed tests with k6.pdfRunning distributed tests with k6.pdf
Running distributed tests with k6.pdf
 
Extending Kubectl.pptx
Extending Kubectl.pptxExtending Kubectl.pptx
Extending Kubectl.pptx
 
Enhancing Data Protection Workflows with Kanister And Argo Workflows
Enhancing Data Protection Workflows with Kanister And Argo WorkflowsEnhancing Data Protection Workflows with Kanister And Argo Workflows
Enhancing Data Protection Workflows with Kanister And Argo Workflows
 
Fallacies in Platform Engineering.pdf
Fallacies in Platform Engineering.pdfFallacies in Platform Engineering.pdf
Fallacies in Platform Engineering.pdf
 
Intro to Fluvio.pptx.pdf
Intro to Fluvio.pptx.pdfIntro to Fluvio.pptx.pdf
Intro to Fluvio.pptx.pdf
 
Enhance your Kafka Infrastructure with Fluvio.pptx
Enhance your Kafka Infrastructure with Fluvio.pptxEnhance your Kafka Infrastructure with Fluvio.pptx
Enhance your Kafka Infrastructure with Fluvio.pptx
 
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdfCNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
CNCF On-Demand Webinar_ LitmusChaos Project Updates.pdf
 
Oh The Places You'll Sign.pdf
Oh The Places You'll Sign.pdfOh The Places You'll Sign.pdf
Oh The Places You'll Sign.pdf
 
Rancher MasterClass - Avoiding-configuration-drift.pptx
Rancher  MasterClass - Avoiding-configuration-drift.pptxRancher  MasterClass - Avoiding-configuration-drift.pptx
Rancher MasterClass - Avoiding-configuration-drift.pptx
 
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptxvFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
vFunction Konveyor Meetup - Why App Modernization Projects Fail - Aug 2022.pptx
 
CNCF Live Webinar: Low Footprint Java Containers with GraalVM
CNCF Live Webinar: Low Footprint Java Containers with GraalVMCNCF Live Webinar: Low Footprint Java Containers with GraalVM
CNCF Live Webinar: Low Footprint Java Containers with GraalVM
 
EnRoute-OPA-Integration.pdf
EnRoute-OPA-Integration.pdfEnRoute-OPA-Integration.pdf
EnRoute-OPA-Integration.pdf
 
AirGap_zusammen_neu.pdf
AirGap_zusammen_neu.pdfAirGap_zusammen_neu.pdf
AirGap_zusammen_neu.pdf
 
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
Copy of OTel Me All About OpenTelemetry The Current & Future State, Navigatin...
 
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
OTel Me All About OpenTelemetry The Current & Future State, Navigating the Pr...
 
CNCF_ A step to step guide to platforming your delivery setup.pdf
CNCF_ A step to step guide to platforming your delivery setup.pdfCNCF_ A step to step guide to platforming your delivery setup.pdf
CNCF_ A step to step guide to platforming your delivery setup.pdf
 
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdfCNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
CNCF Online - Data Protection Guardrails using Open Policy Agent (OPA).pdf
 
Securing Windows workloads.pdf
Securing Windows workloads.pdfSecuring Windows workloads.pdf
Securing Windows workloads.pdf
 
Securing Windows workloads.pdf
Securing Windows workloads.pdfSecuring Windows workloads.pdf
Securing Windows workloads.pdf
 
Advancements in Kubernetes Workload Identity for Azure
Advancements in Kubernetes Workload Identity for AzureAdvancements in Kubernetes Workload Identity for Azure
Advancements in Kubernetes Workload Identity for Azure
 

Recently uploaded

1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
3ipehhoa
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
JungkooksNonexistent
 
How to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptxHow to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptx
Gal Baras
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
Rogerio Filho
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
nirahealhty
 
1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...
JeyaPerumal1
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
3ipehhoa
 
test test test test testtest test testtest test testtest test testtest test ...
test test  test test testtest test testtest test testtest test testtest test ...test test  test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
Arif0071
 
Output determination SAP S4 HANA SAP SD CC
Output determination SAP S4 HANA SAP SD CCOutput determination SAP S4 HANA SAP SD CC
Output determination SAP S4 HANA SAP SD CC
ShahulHameed54211
 
ER(Entity Relationship) Diagram for online shopping - TAE
ER(Entity Relationship) Diagram for online shopping - TAEER(Entity Relationship) Diagram for online shopping - TAE
ER(Entity Relationship) Diagram for online shopping - TAE
Himani415946
 
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and GuidelinesMulti-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Sanjeev Rampal
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
laozhuseo02
 
BASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptxBASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptx
natyesu
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
3ipehhoa
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
laozhuseo02
 
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptxLiving-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
TristanJasperRamos
 

Recently uploaded (16)

1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
1比1复刻(bath毕业证书)英国巴斯大学毕业证学位证原版一模一样
 
Latest trends in computer networking.pptx
Latest trends in computer networking.pptxLatest trends in computer networking.pptx
Latest trends in computer networking.pptx
 
How to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptxHow to Use Contact Form 7 Like a Pro.pptx
How to Use Contact Form 7 Like a Pro.pptx
 
guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...guildmasters guide to ravnica Dungeons & Dragons 5...
guildmasters guide to ravnica Dungeons & Dragons 5...
 
This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!This 7-second Brain Wave Ritual Attracts Money To You.!
This 7-second Brain Wave Ritual Attracts Money To You.!
 
1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...1.Wireless Communication System_Wireless communication is a broad term that i...
1.Wireless Communication System_Wireless communication is a broad term that i...
 
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
急速办(bedfordhire毕业证书)英国贝德福特大学毕业证成绩单原版一模一样
 
test test test test testtest test testtest test testtest test testtest test ...
test test  test test testtest test testtest test testtest test testtest test ...test test  test test testtest test testtest test testtest test testtest test ...
test test test test testtest test testtest test testtest test testtest test ...
 
Output determination SAP S4 HANA SAP SD CC
Output determination SAP S4 HANA SAP SD CCOutput determination SAP S4 HANA SAP SD CC
Output determination SAP S4 HANA SAP SD CC
 
ER(Entity Relationship) Diagram for online shopping - TAE
ER(Entity Relationship) Diagram for online shopping - TAEER(Entity Relationship) Diagram for online shopping - TAE
ER(Entity Relationship) Diagram for online shopping - TAE
 
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and GuidelinesMulti-cluster Kubernetes Networking- Patterns, Projects and Guidelines
Multi-cluster Kubernetes Networking- Patterns, Projects and Guidelines
 
The+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptxThe+Prospects+of+E-Commerce+in+China.pptx
The+Prospects+of+E-Commerce+in+China.pptx
 
BASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptxBASIC C++ lecture NOTE C++ lecture 3.pptx
BASIC C++ lecture NOTE C++ lecture 3.pptx
 
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
原版仿制(uob毕业证书)英国伯明翰大学毕业证本科学历证书原版一模一样
 
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shopHistory+of+E-commerce+Development+in+China-www.cfye-commerce.shop
History+of+E-commerce+Development+in+China-www.cfye-commerce.shop
 
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptxLiving-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
Living-in-IT-era-Module-7-Imaging-and-Design-for-Social-Impact.pptx
 

Api clarity webinar

  • 1. © 2021 Cisco and/or its affiliates. All rights reserved. Open Source API Observability Tool Zohar Kaufman, Alexei Kravtsov Sep 2021
  • 2. © 2021 Cisco and/or its affiliates. All rights reserved. Agenda Why do we need API Specs reconstruction ? Possible open source packages survey Introducing APIClarity (design, architecture) It’s Demo Time Roadmap & closing comments Q&A
  • 3. © 2021 Cisco and/or its affiliates. All rights reserved. Cloud services and microservices architecture gaining popularity Typically using OpenAPI Specification: Standard, language-agnostic interface Allows both humans and computers to discover and understand the capabilities of a service No access to source code or other documentation is needed Interface files for describing, producing, consuming, and visualizing RESTful web services Allows parallel development of client and server applications using generated code and mocks OpenAPI Specs
  • 4. © 2021 Cisco and/or its affiliates. All rights reserved. API Specs Challenges Not all applications have their OpenAPI specification available (legacy, external) Designed API vs Runtime API Deprecated APIs (Zombie APIs) Undocumented APIs (Shadow APIs) Breaking changes Differences over time Obtaining OpenAPI Spec without code instrumentation or modifying existing workloads
  • 5. © 2021 Cisco and/or its affiliates. All rights reserved. API Specs Challenges - Gartner Every connected mobile, modern web or cloud-hosted application uses and exposes APIs: Easy to expose but difficult to defend Used to access data and to call application functionality Large and growing attack surface, leading to a growing number of publicized API attacks and breaches
  • 6. © 2021 Cisco and/or its affiliates. All rights reserved. Existing Open Source Solutions Similar products: Akita, Imvision, Salt Open sources: Optic, Avantation, har2openapi, Response2Schema, InducOapi, SwagDefGen Community tool (free but not open source): API Shark, SwaggerHub List of Tools: Open API Tools, API Specification Toolbox
  • 7. © 2021 Cisco and/or its affiliates. All rights reserved. Open API Tools https://openapi.tools/ Tool Types • Auto Generators: Tools that will take your code and turn it into an OpenAPI Specification document • Converters: Various tools to convert to and from OpenAPI and other API description formats • Data Validators: Check to see if API requests and responses are lining up with the API description • Description Validators: Check your API description to see if it is valid OpenAPI • Documentation: Render API Description as HTML (or maybe a PDF) so slightly less technical people can figure out how to work with the API • DSL: Writing YAML by hand is no fun, and maybe you don't want a GUI, so use a Domain Specific Language to write OpenAPI in your language of choice • GUI Editors: Visual editors help you design APIs without needing to memorize the entire OpenAPI specification • Learning: Whether you're trying to get documentation for a third-party API based on traffic or are trying to switch to design-first at an organization with no OpenAPI at all, learning can help you move your API spec forward and keep it up to date • Miscellaneous: Anything else that does stuff with OpenAPI but hasn't quite got enough to warrant its own category • Mock Servers: Fake servers that take description document as input, then route incoming HTTP requests to example responses or dynamically generates examples • Parsers: Loads and read OpenAPI descriptions, so you can work with them programmatically • SDK Generators: Generate code to give to consumers, to help them avoid interacting at a HTTP level • Security: By poking around your OpenAPI description, some tools can look out for attack vectors you might not have noticed • Server Implementations: Easily create and implement resources and routes for your APIs • Testing: Quickly execute API requests and validate responses on the fly through command line or GUI interfaces • Text Editors: Text editors give you visual feedback whilst you write OpenAPI, so you can see what docs might look like
  • 8. © 2021 Cisco and/or its affiliates. All rights reserved. API Specification Toolbox http://api.specificationtoolbox.com/services/
  • 9. © 2021 Cisco and/or its affiliates. All rights reserved. Optic Open Source tool Helps developers to document, review and approve API changes prior to deploying them Language agnostic, works with any REST API Observes development traffic and learns your API’s behavior Detects API changes by diffing traffic against the current specification Adds an accurate API changelog to every Pull Request Mechanism to manually review and update the specification Not designed to monitor multi service environments
  • 10. © 2021 Cisco and/or its affiliates. All rights reserved. SwaggerHub No need for a setup – generate API traffic from Web UI Records API traffic and converts it to OAS using SwaggerHub Not an open source No integration with runtime environments
  • 11. © 2021 Cisco and/or its affiliates. All rights reserved. API Shark Live monitoring of multi-service environments OAS spec learning from runtime traffic Automatic parameter detection Seamless No Spec Diff detection Not an open source No review option of the learned spec
  • 12. © 2021 Cisco and/or its affiliates. All rights reserved. Live monitoring of multi-service environments Spec Diff detection Not free Not an open source Imvision API Security OAS spec learning from runtime traffic Mechanism to manually review and update the specification
  • 13. © 2021 Cisco and/or its affiliates. All rights reserved. No code changes are needed to any of your App Construct the OpenAPI specification by observing the API traffic UI dashboard to audit and monitor the API findings Alert the user on any difference between the approved API specification and the one that is observed in runtime, detects shadow & zombie APIs Introducing APIClarity Capture all API traffic in an existing environment using a service-mesh framework Allow the User to upload OpenAPI spec, review, modify and approve generated OpenAPI specs
  • 14. © 2021 Cisco and/or its affiliates. All rights reserved. APIClarity: High-Level Architecture Users Istio Client App Envoy Proxy Fronted App Envoy Proxy Backend App Envoy Proxy POST/login GET/clients Mirror API traffic from Proxies OpenAPI Spec Engine UI • API events • Learned Specs • API Diff API spec user review Frontend Pod Client Pod Backend Pod K8s Cluster
  • 15. © 2021 Cisco and/or its affiliates. All rights reserved. Spec Reconstruction Features Parameter detection (Path, query, header, cookie) Object references Security definitions File transfer
  • 16. © 2021 Cisco and/or its affiliates. All rights reserved. Demo Environment K8s cluster Istio service mesh APIClarity installed Sock-shop demo app Setup
  • 17. © 2021 Cisco and/or its affiliates. All rights reserved. Demo Flow 1 2 3 4 5 6 7 APIClarity deployment overview (clone, build, deploy) Visibility of runtime API events Event filtering, hit count graphs OAS learning – generating traffic using the sock-shop demo app Review of automatically generated OAS learned from the traffic Approve the reviewed spec and see in Swagger UI User provided spec Monitor and observe whether the API events correspond to set specs API event diffs, Shadow APIs, Zombie APIs
  • 18. © 2021 Cisco and/or its affiliates. All rights reserved. It’s Demo Time © 2021 Cisco and/or its affiliates. All rights reserved.
  • 19. © 2021 Cisco and/or its affiliates. All rights reserved. API development and security aspects of APIClarity Analyze spec for security issues and best practices Run API fuzzing tests using the spec Generate Client and Server code Generate Client and Server mocks Documentation Knowing the API Spec is the first step to identifying your API risks Mock generation Documentation Fuzzing tests OAS issue analysis Security Development Code generation
  • 20. © 2021 Cisco and/or its affiliates. All rights reserved. Roadmap OAS 3.0, GraphQL, gRPC Integration with additional environments (Browsers, Postman, API gateways, etc.) Support spec schema review in UI System settings User management
  • 21. © 2021 Cisco and/or its affiliates. All rights reserved. Questions? © 2021 Cisco and/or its affiliates. All rights reserved.